CVE-2018-14634

highpriority · act · 90OT risk · criticalKEV · exploitedEPSS 0.147 · 97 %ileexploit · PoCDEEUUS

grimoire priorityP0 · Act now

Exploitable?

Yes · in the wild

CISA KEV · 2 exploits · PoC

Likely / severe?

14.7% (97th) EPSS

CVSS 7.2 · high

Is it mine?

103 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · cert_bund · nvd

added 2026-01-26remediate by 2026-02-16

required action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

EPSS · scored 2026-10-26

Linux Kernel Integer Overflow Vulnerability

An integer overflow flaw was found in the Linux kernel's create_elf_tables() function. An unprivileged local user with access to SUID (or otherwise privileged) binary could use this flaw to escalate their privileges on the system. Kernel versions 2.6.x, 3.10.x and 4.14.x are believed to be vulnerable.

cvss

Technical severity, 0–10. One row per scoring source.

7.8

010

base score 0–10 · higher = more severe · hover a vector to decode

v2.07.2highAV:L/AC:L/Au:N/C:C/I:C/A:Cprimary · NVD / NIST USexploitability 3.9 · impact 10

v3.07.8highCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 1.8 · impact 5.9

v3.07.8highCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.07.8highCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · secalert@redhat.com USexploitability 1.8 · impact 5.9

v3.07.8highCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:Hsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: active · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-190US

exploits (2)

Public proof-of-concept and weaponised exploit code.

affected products (103)

Products and version ranges known to be affected.

Open Source CentOSall versionscert_bundDEcpe:/o:centos:centos:-
Open Source Linux Kernelall versionscert_bundDEcpe:/o:linux:linux_kernel:-
Oracle Linuxall versionscert_bundDEcpe:/o:oracle:linux:-
Red Hat Enterprise Linuxall versionscert_bundDEcpe:/o:redhat:enterprise_linux:-
SUSE Linuxall versionscert_bundDEcpe:/o:suse:suse_linux:-
The Linux Foundation Kernel≤ 2.6.x, 3.10.x, 4.14.xenisa_euvdEU
canonical ubuntu linux= 12.04nvdUScpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*
canonical ubuntu linux= 14.04nvdUScpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*
f5 big-ip access policy manager11.2.1 → 11.6.4nvdUScpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*
f5 big-ip access policy manager12.1.0 → 12.1.5nvdUScpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*
f5 big-ip access policy manager13.0.0 → 13.1.1.5nvdUScpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*
f5 big-ip access policy manager14.0.0 → 14.0.1.1nvdUScpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*
f5 big-ip access policy manager14.1.0 → 14.1.0.6nvdUScpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*
f5 big-ip advanced firewall manager11.2.1 → 11.6.4nvdUScpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*
f5 big-ip advanced firewall manager12.1.0 → 12.1.5nvdUScpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*
f5 big-ip advanced firewall manager13.0.0 → 13.1.1.5nvdUScpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*
f5 big-ip advanced firewall manager14.0.0 → 14.0.1.1nvdUScpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*
f5 big-ip advanced firewall manager14.1.0 → 14.1.0.6nvdUScpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*
f5 big-ip analytics11.2.1 → 11.6.4nvdUScpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*
f5 big-ip analytics12.1.0 → 12.1.5nvdUScpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*

showing 20 of 103

advisories (1)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2026-0217Linux Kernel: Schwachstelle ermöglicht PrivilegieneskalationDeutsch2018-09-25csaf · cert_bundDE
Ein lokaler Angreifer kann eine Schwachstelle in Linux Kernel und Red Hat Enterprise Linux ausnutzen, um seine Privilegien zu erhöhen.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd cert_bund nvd NVD CVE.org MITRE

published 2018-09-25modified 2026-06-17

references (83)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan